The DMZ

Simon

12:46 AM

@ScottPack Will you please marry me?

2

Griffin

2:29 AM

@Simon No matter what he says we can always be together!

Simon

@Griffin Thanks Griffin, I got so damn excited because I thought it was @ScottPack who said he'd marry me.

Griffin

@Simon Idk. But just know the offer is always on the table ;)

Simon

@Griffin I'll think about it, this is no easy decision.

Griffin

@Som

@Simon Remember sometimes you have to settle for second best.

AviD

6:23 AM

@Adnan oh yeah, and we both forgot a big one: COFFEE.

Don't forget to be naked inside a Faraday cage. — lynks Jan 9 at 15:14

TildalWave

6:40 AM

@AviD Cinzano, Gancia, Campari, Barbieri,... just to name a few big spirits companies, and e.g. Cynar is utterly Italian, also Crodino, Aperol,... anyway, I've never really been thirsty in Italy ;)

AviD

never heard of any of those. What are they?

but btw it was @Adnan that made the claim about italian beverages, not I.

TildalWave

@AviD Oh sry :) And Wiki for descriptions, they're too different all

AviD

@TildalWave meh, I think @Adnan would count them all (or almost all) as wines

TildalWave

@AviD no, none of them are wines... plus italians actually have many quite different wines, for example Chianti, Canaiolo, Orvietano,... that I personally wouldn't mix among other wines, they're quite distinct IMO (but that would depend on one's palate)

Italians are quite hedonistic, I doubt they lack on anything worth enjoying ;)

Oh, and let's not forget this:

AviD

7:03 AM

@TildalWave I am.... confused? What was your point again?

TildalWave

@AviD That you can't really say Italy has a poor choice of drinks... they would probably have anything worth keeping that used to exist within the Roman empire

Lucas Kauffman

7:16 AM

Dem downvotes

AviD

you fellas all see this? it's kinda amusing read...

414

Q: Worst security hole you've seen?

What is the worst security hole you've ever seen? It is probably a good idea to keep details limited to protect the guilty. For what it's worth, here's a question about what to do if you find a security hole, and another with some useful answers if a company doesn't (seem to) respond.

security

Lucas Kauffman

@AviD good read

lot's of cool stuff from the old days

Terry Chia

@AviD I like that story from Eric.

AviD

@TerryChia don't tell @TildalWave, he'll post nasty comments ;-)

TildalWave

@AviD Don't be absurd. Just because I dislike the guy's one stance on security, that doesn't mean I have a personal relationship with him. I'm not that desperate :P

AviD

7:29 AM

@TildalWave haha, cmooooon then, I was trolling you, you should know that.

That's what the winkie meant...

Terry Chia

@TildalWave Don't lie. We all know you are a real jerk going around hating people for no good reason.

TildalWave

@AviD You see now? That's what I wanted to tell all of you here when you jumped on me for commenting on that one answer... and I commet quite similarly to many others (as many of you do), nobody cared to correct me then

@TerryChia Watch it, or I'm gonna jump into the shower and hate you for a while!

AviD

@TildalWave yeah, well, the man is a demigod, give him the special respect ;-)

@TildalWave that... that is probably one of the worst things I've heard here in a while, and considering @Adnan, that really says a lot.

TildalWave

@AviD Then you read it all wrong

AviD

@TildalWave no no, I think you wrote it all wrong.

Terry Chia

7:34 AM

Come on, I need 2 more downvotes here.

-1

A: URL & address bar spoofing, only possible on rogue access point

This is indeed very possible with most browsers. See this link for a nice explanation on how to pull it off. In general, the only thing that can be trusted in a browser is the padlock indicating that the page is served through SSL. Any other object on the browser can be manipulated some how or o...

TildalWave

@AviD Blimey, you woke up on the wrong side of the bed this morning? You take arguments with me for failing to amuse you, yet you fail to comment on @Simon proposing to @ScottPack?

AviD

@TildalWave lol, yeah I just ignore those. Not enough entertainment value, just plain creepiness.

TildalWave

@TerryChia why?

Terry Chia

@TildalWave Badge whoring obviously. :)

TildalWave

@TerryChia peer pressure?

Terry Chia

7:37 AM

@ManishEarth Pointed out my mistake so I might as well get a badge in the process of deleting it

@TildalWave Yup.

AviD

@TerryChia NOPE!

TildalWave

@TerryChia well that's a first for me to see someone begging for downvotes, so you have mine just for that (call it entertainment value)

Terry Chia

@TildalWave :)

1 more 1 more!

AviD

@TerryChia What did the sadist answer when the masochist said to him "HIT ME! HIT ME!"?

TildalWave

@AviD I'm impartial to demigods, it's what's also called integrity. :P

AviD

7:42 AM

@TildalWave MS Hater!!

yes, yes I AM kidding.

Rory Alsop

9:00 AM

@TerryChia badgewhore

Terry Chia

@RoryAlsop Aye, thanks. :)

TildalWave

@TerryChia now you need the disciplined badge to complete your collection :P

AviD

9:53 AM

the code review I'm currently doing (forced to do this in notepad++, btw) :

so pretty much anything I want to find is there... somebody throw me an esoteric vuln to find? yknow, for funsies.

Lucas Kauffman

@AviD what language and platform?

AviD

@LucasKauffman ah, see that's whats special...

its Java... on Oracle's shame known as AIS.

Lucas Kauffman

AIS?

never heard of it

AviD

heard of ADF?

Lucas Kauffman

no :(

Faster and Simpler Java-based Application Development
Oracle ADF is an end-to-end Java EE framework that simplifies application development by providing out-of-the-box infrastructure services and a visual and declarative development experience.

AviD

10:01 AM

similar to JSF - faces templating etc.

but also "regular" jsp, jee, etc.

@LucasKauffman hehe, "simplifies"

I think Oracle is using a different dictionary than the rest of us.

AIS also supports db-driven html rendering engine. I.E. HTML - AND server code - stored in the database.

No, its great! then all the application is dynamic!

I'm pretty sure I've seen a few TDWTF articles on it...

but they're not using THAT feature, at least....

nevermind that, though... only thing I've looked for and HAVENT found is RFI.

(yet...)

Lucas Kauffman

you got command injection?

AviD

any other generic web attacks?

@LucasKauffman close enough. indirectly...

havent looked for EVERYTHING yet, just started the other day...

they wanted me to install oracle's ide (was it intelliJ?), so first I spent a while deciding NOT to do that. After trying - and failing - to load it in eclipse.

its usually not this... this... well, typical.

I prefer clients with a bit more of a professional challenge, not a technicalities one.

TildalWave

10:18 AM

@AviD Custom HTML tag replace? Basically, find a custom tag or any other hook that the scripts will replace with content that's not supposed to be there.

AviD

@TildalWave hmm, interesting... ymean on the serverside, and run it as servercode?

otherwise its just xss.... though I'm not sure adf works that way, but yeah definitely worth looking into.

TildalWave

@AviD well any side, if it's not sanitized really... pass it as a search query even, whatever... if the template system uses hooks (however you wanna call them, almost each framework calls that differently), find one that is privilege escalation type, dunno let's say hooks are of format <#customname param1=value1 param2=value2 ... /> then find one that will replace something of value, maybe <#QUERY sql="SELECT * FROM Users" />

if you have access to the server end, then try searching for some interesting hooks to exploit in CMS templates for example

AviD

10:39 AM

@TildalWave I have code only... but yeah, exploiting the templating engine is on my todo list... have to spend some time learning how that engine works (and cant just try things blindly, like I said I have the code only and ZERO interest in trying to setup a server...)

Lucas Kauffman

@AviD nah InteliJ is actually pretty good

AviD

@LucasKauffman no sorry, it was Oracle Jdeveloper.

Lucas Kauffman

:p

AviD

some proprietary extensions, so it wont really load intelligently in eclipse.

and the code is just pretty bad. Well, the developer did admit this himself, the code is pretty "legacy", so he's pushing for a complete rewrite in some modern technology.

have to say I agree with him.

and this is just on the 2nd day...

Lucas Kauffman

@AviD it's still java so getting another framework shouldn't be too hard

AviD

10:49 AM

the problem isnt even just the framework, the code, the architecture, its all pretty shoddy.

Lucas Kauffman

@AviD sounds typical, but why would they want to have a source code review on it if they are going to rewrite it anyway

AviD

@LucasKauffman that's not untypical - they need to prove to management that the budget would be better allocated to a rewrite than trying to fix everything.

but yeah, it is frustrating... its like you KNOW noones going to bother really reading that damn report.

Lucas Kauffman

@AviD It's like those end of year assessments where they need to burn the budget ASAP

I had to scan 2 IPs during 3 days

wasn't allowed to touch applications

the report was pretty empty

AviD

no, its worse - its not like well, this money is going byebye anyway, might as well get some use out of it.

its more like - the bosses wont let us replace this, so lets get somebody to tell them its broken beyond fixing...

TildalWave

11:09 AM

@AviD code is all you need really... happy hunting ;)

AviD

@TildalWave right, but I'll have to dig into the internals of the templating engine, at least to find the interesting secbugs....

@TildalWave hunting? No, this is more like making soup out of your pet rabbits ;-)

cant take 3 steps without tripping all over the damn furry things.

TildalWave

@AviD romper stomper! :))

D3C4FF

12:30 PM

Whats up kidz

?

Terry Chia

@D3C4FF Some lovely Java bashing from @AviD mostly.

D3C4FF

@TerryChia Standard issue then :P

I finally set up my RasPi seedbox. 8TB of attached storage. Hot-dang!

Terry Chia

@D3C4FF Nice! What are you using for the storage?

D3C4FF

2x4TB Segate 'Expansion Drives'

I've got a third set up and ready to go when they get full

cost $130 AUD each :O :O :O

Terry Chia

@D3C4FF That's pretty damn cheap! :O

I'm gonna wait for Black Friday before making major upgrades to my storage capacity.

D3C4FF

12:38 PM

I'm about 750 GB off 30TB now :D

Terry Chia

I kinda want a Thunderbolt RAID enclosure but damn they are expensive.

Hennes

Aye

Nice, but not cheap

AviD

@TerryChia heeey, I wasnt bashing "Java", I was bashing this specific application, which happened to be in java.

Oh yeah, and some Oracle bashing.

Hennes

I just use 'internal thunderbolt' (aka PCI-e)

D3C4FF

@TerryChia Yeah, USB3.0 is pretty sweet though. It can R/W @ 90MB/s which is more than enough for most use cases, especially since that's usually the max of a 7.2k RPM drive anyway

Hennes

12:39 PM

For a single drive: Aye

When you are going to external RAID: No

eSATA and port multipliers, or SAS, or thunderbolt will be so much nicer

D3C4FF

@Hennes Ah yeah, if its RAID 0 or something

Hennes

I just use the dreaded combination of RAID 5 on large SATA disks.

Never do that in a professional environment.

D3C4FF

@Hennes Lulz. I did

Terry Chia

@TildalWave Done. :P

D3C4FF

It did not work out well

Hennes

12:40 PM

Large disks?

AviD

@D3C4FF I thought it was more like 250 mb/s?

D3C4FF

@Hennes 2TB disks

Hennes

Or 147GiB 15k RPM SAS

ugh

Terry Chia

@Hennes Which one is RAID 5 again?

Hennes

Rebuild time are going though the roof

N-1

D3C4FF

12:41 PM

@AviD Nope. maybe in theory, but not in pratice for me, on spinning (non-ssd disks)

Hennes

Data written to N+1 disks, with a single disk redundancy.

D3C4FF

@Hennes Correct. Makes me nervous when it takes days to rebuild RAID arrays, espeically if all the disks were purchased at the same time! :P

AviD

@D3C4FF ah, okay - so the chokepoint is the spinners, not the usb3 (or any other connection, for that matter).

Hennes

Which seems nice (except for the write hole)

Terry Chia

@Hennes Ahh.

D3C4FF

12:42 PM

@AviD Yeah, i'm fairly sure, I've not seen/tried any USB3 SSD's

Hennes

but if one drive fails and you replace it that you are going to do a lot of reads (read: stress the remaining array) for a long time. Usually on the same generation disks, with the same uptime, as the drive which just failed.

D3C4FF

@AviD even my CF cards for my camera are max 90MBs

Hennes

Add googles 'bathtub curve' on drive failures and sit back to enjoy the show

AviD

@D3C4FF nor I, but I've seen some sweet reviews.

Terry Chia

I'm eventually just gonna go RAID 1 on 4x 4TB I guess. 8TB of storage is sufficient for me currently.

AviD

12:43 PM

especially from JeffAtwood, that ol' hardware fanboi.

Terry Chia

I'm still waiting for Corsair to release that damned flash drive.

6 months and counting.

Hennes

I am at 1x76GiB (SSD), 4x1TB (SATA), 1x 146GB (SAS)

I want to replace the SSD with a faster one and move the old SSD to my laptop

D3C4FF

@Hennes I've got 2x 146GB 15k SAS disks which are new that i've never bothered to even take out of the anti-static bags...

Hennes

And maybe add two of my backup drives (2TB WD blacks)

Terry Chia

Seriously though, @D3C4FF. What the fuck do you need 30TB of storage for? :P

Hennes

12:45 PM

15k RPM SAS (146 or 73 GB) is almost as expensive as their SSD counterparts

Which are not SAS, but that barely matters at home

ManishEarth

@TerryChia Probably porn :P

Terry Chia

@ManishEarth Ah, so @D3C4FF hosts a porn site?

Hennes

Crap. I misread a bug

D3C4FF

@TerryChia @ManishEarth 15TB of Rainbow tables, 5TB of databases, 10TB of Music, Movies, TV

Hennes

FReeBSD write to a read only file is mmap based, not nmap.
(Not sure how nmap would have worked, but ... )

ManishEarth

12:51 PM

@D3C4FF Nice

D3C4FF

So many tables, so much rain... Damn winter

Terry Chia

What RPM disk do you guys usually get for this sort of purpose? 7200?

AviD

@TerryChia I go for the slow, cool'n'quiet "green" drives.

spinner disks are so ridiculously slow compared to SSD anyway, you'll barely notice the difference in comparison.

'course, I'm not running anything as ridiculously disk-intensive like @D3C4FF's porn site....

3

Terry Chia

Ah well, I guess i'll consult @D3C4FF again once I find the cash (and convince my dad).

AviD

1:07 PM

@TerryChia your dad is helping you set up a porn site? I guess it will be one of those kinky fetish sites, then.

Terry Chia

@AviD No. I have no ambitions of running a porn site. Being a customer is enough.

AviD

Sorry @TerryChia, I know that one was borderline, but I just couldnt resist :-)

Terry Chia

@AviD flag as spam/offensive

AviD

heh, naaaahh. It is starrable, though.

D3C4FF

1:52 PM

I like the fine line between flag as spam/offensive and its starrable

TildalWave

2:06 PM

@TerryChia wow you're full of surprises, what answer did you delete?

Terry Chia

@TildalWave Some random 2 liner answer that somehow got 3 upvotes. Can't remember which one now.

TildalWave

@TerryChia OK OK yes you have thousands of those, how could you remember? :P j/k

AviD

@D3C4FF there is a line?

ManishEarth

@TerryChia if you undelete it you keep the badge :P

Terry Chia

@ManishEarth Damn, that's smart!

ManishEarth

2:10 PM

Not sure if it's considered abuse though

As a moderator I know all sorts of ways to circumvent the system

@TildalWave could be my sockpuppet and @AviD would never find out :P

Terry Chia

@ManishEarth At least you share them with us mortals. Unlike that jerkface @AviD.

ManishEarth

:P

Badges aren't important, and that trick is well known, so I can share it

AviD

@ManishEarth for all you know, I am your sockpuppet.

ManishEarth

Details on the vote fraud tools: Nope :P

AviD

@TerryChia term of endearment aside, what makes you think I know any of the modtricks?

Simon

2:12 PM

@AviD Plain creepiness? Maybe you'll know what it's like when you find true love.

AviD

you know I'm a broken moderator.

@Simon hehe, yeah that.

Simon

@AviD Morning :)

ManishEarth

AviD

@ManishEarth BBBZZZZRRRRRRRTTTT!!! Minus two geekpoints for you.

Xander

@AviD That brings back memories. I first knew for sure that I hated Oracle when I found the HTML extensions to PL/SQL. It's like they went looking for any possible way you might ever want to use data in an application, and then bolted a way to build the application straight onto the RDBMS. It's the most ridiculously overbuilt mess ever unleashed on IT.

ManishEarth

2:15 PM

Hey!

AviD

your feeble attempt is based on the well-known saying by Darth Vader, "Luke, I *am* your father."

Unfortunately, he never actually said that.

ManishEarth

Oh right

Simon

What did he say, exactly?

AviD

@ManishEarth "No! *I* am your father."

ManishEarth

No, ...

@Simon Yeah what @AviD said

AviD

2:17 PM

►

Simon

Oh, I guess it wouldn't make sense or wouldn't be recognized without the "Luke".

AviD

@Simon Frankly, my dear, I dont give a damn.

--> Another well known saying that was never said in its original setting.

Simon

@AviD But I wanted to have a huge argument about it, le fu-.

ManishEarth

@AviD The same goes for "The British are coming! The British are coming!"

Well, it was said, but not in Boston, somewhere in Israel

AviD

@ManishEarth oh, no, that WAS said, but not by that guy, but by the town prostitute.

4

ManishEarth

2:21 PM

The Paul Revere incident was "The redcoats are coming!". At the time, the revolutionaries still considered themselves British

@AviD LOL

Simon

@AviD 10/10 would star again.

TildalWave

@ManishEarth Out of all due respect, but how do you know that I'm not your sockpuppet already? Or @AviD's for the matter... I'm pretty sure I've upvoted both of your posts even today (no, nothing to do with "who you are" but I was digging through archives again :P)

AviD

@TildalWave well, sure, but thats because we're both demigods.

ManishEarth

@TildalWave What @AviD said :P

TildalWave

@AviD don't make me step into the shower again :P

oups, I forgot @AviD doesn't like that, sry :))

neah I was digging for some old answers on some SSL thingy and it just so happens I think both of your posts were there and good enough as far as I can tell at least LOL

needless to say that meant the bear prolly got ~ 10 upvotes out of 20 something hehe

Hennes

2:46 PM

Heh!

<div id="lessonContent"><form accept-charset='UNKNOWN' method='POST' name='form' action='attack?Screen=40&menu=700' enctype=''><h1>Sign In </h1><table align='center' cellspacing='0' width='90%' border='0' cellpadding='2'><tr><th colspan='2' align='left'>Please sign in to your account.

Terry Chia

@Hennes What.....

facepalm

Hennes

Mental note to self: If I ever write a webpage, leave in comment like that.
But make sure it does something quite different than what is expected.

ManishEarth

@Hennes the admin passwd is in the source? O_0

Hennes

Yes. Webgoat, so it is supposed to be insecure.

Terry Chia

@Hennes Hah! You could write an entire other site for that special login.

That would really mess with them.

@Hennes Ahh.. I thought it was a production system some where.

Hennes

2:49 PM

I went back to cache poisoning. I still do not get that to work.

I spent about 10+ hours on it

Terry Chia

Self-plugging: Really handy for sorting through comments. :P gist.github.com/Ayrx/5791379

Hennes

Including with the solution

The most fun I had with passwords was on the intranet site of the town ofs councilRotterdam

INTRAnet

Connected to the INTERnet, because that was handy

Username and password were in plain text on the front page, so that people could not forget it.

Terry Chia

@Hennes Honor system. Because that always works out well.

Hennes

It was fun what that hit the news.

Hennes

5:10 PM

Dear PRISM: Yes I have just listened to the same song 6 times on youtube. Stop judging.

5

Griffin

5:27 PM

@Hennes If you don't like my playlist stop listen to it.

@Hennes Prism judges so hard.

copy

6:38 PM

Welcome to security.stackexchange.com. Please read our about and faq page. This question is not considered on topic for this website. — Lucas Kauffman 1 min ago

Damn, fixed :(

Lucas Kauffman

7:09 PM

@copy yes.

Adnan

7:42 PM

Hellooow!!

Hewwo :(

Badger Girl

@Adnan Hello :)

Adnan

@BadgerGirl yaaay! There's somebody here! That shall be celebrated by opening a beer.

Jun 19 at 8:30, by Adnan

@LucasKauffman I have justify my alcoholism somehow

ManishEarth

@Adnan I'm here too. Have another :)

Adnan

@ManishEarth I was saving the Guinness for next Friday, but I guess I have to drink it now

ManishEarth

CHUG CHUG CHUG

Adnan

7:58 PM

I was so happy after finishing my stupid PHP project. Now I have a JavaScript project. I don't know, I feel like I'm paying for all of the awful things I've done in the past.

One of the files is a 2k line JavaScript "class".

I was so angry I yelled "Who's the idiot who wrote this shit?", then I checked the SVN logs "Ownership: 95% -- adnan".

Hennes

So, I guess you get paid per line of code?

Adnan

@Hennes No. Are there any companies that pay per LoC?

Hennes

Yes
there
are.

/*
I
am
sure
of
it*/

There is at least one place where the manager checks how many commits are made and judges your productivity on that

Which is similar.

Adnan

@Hennes I don't think that such metrics are used here. We have a very different culture in the company.

Hennes

You are lucky.

Adnan

8:10 PM

@ManishEarth and now the Guinness is opened.

ManishEarth

ha

Hennes

Else you end up fixing code, and then commiting it in batches at the end of the day

Adnan

@ManishEarth Kippis!

ManishEarth

Had to google that :P Cheers!

Also, I actually don't drink :P

(I've tried all sorts of things, but I don't like 'em)

AviD

@ManishEarth seriously? mod on chemistry, but you dont know about brewing beers?

ManishEarth

8:20 PM

lol

AviD

how else do you even get experience in chemistry?

ManishEarth

I'm not a chemist

And probably never will be

Going to do physics (or maybe switch to programming... or infosec ^.^)

@AviD Blowing stuff up in the lab :P

AviD

@ManishEarth ah, that could be interesting.

what do you blow up, like bottles of meth?

ManishEarth

:P no

But I know how to make poisonous cyanide derivatives

Hennes

H-CN ?

Adnan

8:25 PM

@AviD He had to Google "Kippis".

@ManishEarth I guess this could be used against you in your next trial.

Hennes

Small, Smelly Isocyanides ?

ManishEarth

@Hennes phenyl isocyanide. Aniline+Chloroform+KOH+heat

loves Corante's blog

Adnan

@AviD By the way, is it לחיים ? (cheers)

Hennes

I am not a chemist, but I do read some of his articles.

AQs well as fun things, such as ignition - an informal history of liquid rocket propellants

Adnan

@AviD It sounds a little strange, because AFAIK חיים is life. So if you add ל it should become "for life", right?

Hennes

8:28 PM

Hg based rocket engines...... fun

Please give that tech to the enemy

AviD

@Adnan ohhh du

@Adnan yeah! (pronounced "leChayim!")

(ch is the gutteral sound, similiar to the dutch "g", but harder)

Adnan

@AviD Oh come on! I know how to pronounce ח

AviD

@Adnan thats correct, or rather "to life". as in, imbibing is healthy, and adds to your life (and not to drink yourself into a grave).

@Adnan hehe, okay okay

Adnan

@AviD ahaaa! That makes sense

Hennes

From the chapter: High Density and the Higher Foolishness:
Well,dimethylmercurywasdense,allrigh t—
d=3.07—butitwouldbeburne dwithRFNA,an datareasonabl e
mixturerati oth etotalpropellantdensitywouldbeabout2.1or2.2.
(Th edensityoftheacid-UDM Hsystemisabou t1.2.)Tha tdidn' tseem
to oimpressive ,an dIdecidedtoapplyth ereductoadabsurdummethod.
Whynotuseth edensestknownsubstancewhichisliquidatroo m
temperatur e—mercuryitself?Jus tsquirtitint oth echambe rofa
motorburning ,say,acid-UDMH.I twouldevaporateint oamon-atomicgas(withalowCp,whichwouldhelpperformance),an dwould

Hmm, why does it eat the whitespace ?

AviD

8:42 PM

its hungry?

Adnan

@AviD Whose hungry?

AviD

whatever's eating the whitespace?

Adnan

@AviD It was just a hit on your grammatical error. It should be "it's". That's why I asked with "Whose" and not "Who's".

I feel like I'm taking @Terry's role.

AviD

yeah, I got that, but it was a "grammatical error", it was a grammatical lacking.

Hennes

Knock knock.

*Who's there?*

To.

*To who?*

To whom.

OK, enough grammar. :)

AviD

8:52 PM

@Hennes lol

I am so going to tell that one to my mother the english teacher.

Adnan

@AviD You're gonna tell it to who?

AviD

heh

Rory Alsop

9:37 PM

@Adnan and @AviD - it's the same as Whisky: uisge beatha = Water of Life

AviD

@RoryAlsop ahhh yeeaaahhh

Rory Alsop

@AviD SO anyway - that's a 50 litre cask of whisky laid down. Ten year's time I'm gonna have some good whisky :-)

AviD

@RoryAlsop whoa, really?

Rory Alsop

And the distillery that is doing it for me can do me an orange-infused gin (for the band)

AviD

you need to get yourself a time bubble.

@RoryAlsop haha excellent

Rory Alsop

9:40 PM

@AviD hahahaha - I have. It is in a nice american oak, lightly charred and peated sherry cask

AviD

@RoryAlsop sounds delish.

Adnan

@RoryAlsop Wait wait wait ... WAAAAIT A SECOND HERE!

You're making your own whiskey?

AviD

@Adnan well, you know he grew up in a distillery, right?

Rory Alsop

@Adnan well, almost - I have a friend who is a distiller...he is making it. I just get to define the start point, and some key decisions throughout its life span

Adnan

@AviD Yeah, he mentioned that. Highland Park

@RoryAlsop That's so exciting!

AviD

9:42 PM

"Open it now?"
"No, not yet."

Rory Alsop

And a friend is laying down a second cask with some different properties - so in a few years we will start taking bottles. Some single cask, and some mixed :-)

@AviD heh

AviD

"How about noooowww....?"
"YESSSSSS!!!"

Rory Alsop

@AviD looking forward to it. This guy has a great job - runs his own distillery, and is head of distilling research at one of the Edinburgh universities!

AviD

@RoryAlsop haha, only in a Scottish university... Professor of Whiskies!

4

Rory Alsop

@AviD I know, right.

Hennes

10:41 PM

The water of life. :)

Transcript for